Privacy Policy

This Privacy Policy describes how LeagueHaus LLC, a South Carolina limited liability company ("LeagueHaus", "we", "us", or "our"), collects, uses, and shares information when you use our website, our iOS and Android apps, and the related services (together, the "Service"). The apps are covered by this Policy in the same way as the website. By using the Service, you agree to the practices described here. If you do not agree, do not use the Service.

LeagueHaus is used by venues (bars and other businesses) to run leagues for their players. Venues decide who can join their leagues and see some of their members' information, as described in Section 3.

1. Information We Collect

a. Information you provide

• Account information — name, email address, and (optionally) a profile photo
• League, venue, team, season, schedule, roster, RSVP, and game-result data you submit, and the email addresses of people you invite
• Announcements and other content you post inside a league
• Venue profile information — venue name, address, description, and logo — and sponsor names and logos a venue adds
• Billing information (venues only). Paid plans are billed to venues, never to players. For a paying venue we keep its legal or business name, billing contact name and email, billing address, and its invoice and payment records. We invoice monthly and are paid directly by bank transfer (ACH) or check; we do not take card payments and do not use a payment processor.
• Support requests you send us, including any app and device details the support form attaches to help us diagnose the problem (app platform and version, the page you were on, and your browser's user-agent)
• Venue inquiries. If you ask about LeagueHaus for your venue through our "Talk to us" form, we collect your name, email, phone number (optional), venue name and city, and the details you give about the leagues you run. You do not need an account to send this form.

b. Information collected automatically

• Log data needed to operate the Service — timestamps, request paths, status codes, and your browser or device user-agent
• Performance measurements — once per page view, the page sends a small report of load and responsiveness timings, the page's route with any identifiers or codes removed, and whether it ran in a browser or in our iOS or Android app. Browsers may also report security-policy violations to us.
• IP address, used for rate-limiting, abuse prevention, and security
• Authentication cookies and session tokens (see Section 6)
• If you turn on notifications, a push token: in a browser, a web-push subscription endpoint; in our iOS or Android app, the device push token Apple or Google issues for that app on your device

We do not use advertising identifiers, third-party analytics, or tracking pixels, and we do not collect your precise location.

c. Information from other people

Other people using the Service may give us information about you — for example, a league manager or team captain who invites you by email, or a manager who records your team's scores, attendance, or check-in on a league night.

2. How We Use Your Information

We use the information described above to:

• Create and authenticate your account and keep you signed in
• Operate league features — standings, schedules, rosters, calendars, notifications
• Send transactional email (sign-in links, reminders, role changes)
• Deliver browser and app push notifications you have turned on
• Invoice paying venues and keep billing, accounting, and tax records
• Respond to support requests, venue inquiries, and privacy requests
• Measure and improve the Service's performance, diagnose problems, prevent abuse, and keep a record of administrative actions for security and accountability
• Comply with legal obligations and enforce our Terms

We do not sell your personal information, use it for targeted advertising, or use it to make automated decisions that have legal or similarly significant effects on you. The legal bases we rely on for EEA/UK users are set out in Section 11.

3. How We Share Information

We do not sell your personal information. We share information only as follows:

• With other members of your venue or league. Your name, profile photo, role, team membership, and game results are visible to other members of leagues you join. Venue and league managers see your email address only if you have opted in to share it with that venue (below); otherwise they see a masked form of it.
• With a venue, for its own mailing list — only if you opt in. A venue can ask you to share your name and email address for its own marketing, and its league managers can then export those details to use outside LeagueHaus. This is off by default, granted per venue (never across all venues at once), and you can withdraw it at any time from Settings → Venue mailing lists. Withdrawing removes you from every future export; we cannot recall a copy the venue has already downloaded. Only your name, email, the leagues you belong to at that venue, and your join date are included.
• Publicly, for public leagues. If a venue lists a league publicly, anyone can see its schedule, standings, team names, and announcements (including the name of the manager who posted them).
• Through uploaded images. Profile photos and venue and sponsor logos are stored in our database and served from a web address that does not require signing in, so anyone who has that address can view the image. We re-encode uploaded images and remove embedded metadata such as camera details and location.
• Through calendar feeds you subscribe to. A league calendar link lets your calendar app fetch the league's schedule (night dates and times, league name, and venue name and address). The link does not expire, and anyone who has it can see that schedule. For a private league the link stops working when you leave or are removed from the league, and a league admin can reset the league's calendar links at any time, which disables every previously issued link.
• With service providers (sub-processors) who process data on our behalf under contractual confidentiality and security obligations. See Section 4.
• For legal reasons — to comply with applicable law, valid legal process, or to protect the rights, property, or safety of LeagueHaus, our users, or others.
• In a business transfer — if LeagueHaus is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4. Service Providers

We use the following kinds of third-party providers to operate the Service. Each acts as a processor under our instructions and is bound by confidentiality and security obligations:

• Cloud hosting — application hosting, database storage (including uploaded images and backups), and server logs, on servers located in the United States
• Email delivery — sending transactional email (sign-in links, reminders, notifications), forwarding messages to our support and venue-inquiry inboxes, and bounce and complaint reports
• Email hosting — the inboxes that receive support requests, venue inquiries, and privacy requests, on servers located in Switzerland
• Apple Push Notification service (APNs) — delivery of push notifications to our iOS app, using your device push token and the notification's content
• Google Firebase Cloud Messaging (FCM) — delivery of push notifications to our Android app, using your device push token and the notification's content
• Browser push services (Apple, Google, Mozilla, Microsoft, and similar, depending on your browser) — delivery of browser push notifications you have turned on

Venues that need the names of our providers, for example under a data processing agreement, can request a current list at privacy@leaguehaus.app.

When you download our apps, Apple (App Store) and Google (Google Play) also collect information under their own privacy policies; we do not control that collection.

5. International Data Transfers

LeagueHaus is based in the United States, and we store and process information there. If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, whose data protection laws may differ from those of your country.

Where personal data of EEA or UK users is transferred to us or our service providers, we rely on safeguards recognized by applicable law: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum (or UK International Data Transfer Agreement), or a recipient's certification under the EU-U.S. Data Privacy Framework and its UK Extension, as applicable. You can ask for more information about these safeguards, or a copy of them, at privacy@leaguehaus.app.

6. Cookies and Similar Technologies

We use only the cookies strictly necessary to operate the Service — primarily authentication and CSRF tokens. Our iOS and Android apps use the same sign-in session as the website. We do not use third-party advertising or cross-site tracking cookies. See our Cookie Policy for the full list and how to control them.

7. Data Security

We use industry-standard security measures, including encryption in transit (TLS), encryption of sensitive credentials at rest, role-based access controls, and least-privilege practices for internal access. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We keep personal information only as long as we need it for the purposes in this Policy, including legal, accounting, and security requirements. Except as shown below, when you delete your account we delete or anonymize your personal information within 90 days.

9. Your Rights and Choices

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your information
• Export a copy of your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where we rely on consent

Many of these you can do yourself: edit your profile, export your data, or delete your account from Settings → Profile; turn notifications off in Settings → Notifications or your device settings; and withdraw venue mailing-list sharing from Settings → Venue mailing lists. For anything else, contact us at privacy@leaguehaus.app. We will respond within the time required by applicable law.

Verifying your identity. To protect your account, we verify requests before acting on them, usually by asking you to send the request from, or confirm it through, the email address on your account. We may ask for more information if we cannot verify you that way, and we use it only for verification.

Authorized agents. Where the law allows, you may have an authorized agent make a request for you. We will ask the agent for your signed permission (or a valid power of attorney) and may ask you to confirm your identity with us directly.

Appeals. If we decline your request, we will explain why. You can appeal by replying to our decision or emailing privacy@leaguehaus.app with "Privacy appeal" in the subject. We will tell you the outcome and our reasons within the time the law requires. If you are not satisfied, you may contact your state Attorney General or, in the EEA or UK, your data protection authority.

We will not discriminate against you — for example, by denying you the Service or charging a different price — for exercising any of these rights.

10. U.S. State Privacy Rights

This section applies to residents of U.S. states whose privacy laws apply to us, including California, Colorado, Connecticut, Virginia, and other states with comparable laws. It describes our practices now and during the past 12 months. Not every right is available in every state.

a. What we collect and why

We do not collect sensitive personal information (such as government ID numbers, financial account credentials, precise location, or health data), and we do not draw inferences about you to build a profile.

b. Your rights

• Know and access — the categories and specific pieces of personal information we hold, where it came from, why we use it, and who receives it
• Delete — personal information we collected from you
• Correct — inaccurate personal information
• Portability — a copy in a portable, machine-readable format
• Opt out — of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these, so there is nothing to opt out of; if that ever changes, we will update this Policy and give you a way to opt out first.
• Non-discrimination — for exercising any of these rights
• Appeal — a decision to decline your request

Section 9 explains how to make a request, how we verify it, how authorized agents can act for you, and how to appeal.

c. Sale, sharing, and de-identified data

We do not sell personal information, "share" it for cross-context behavioral advertising, or process it for targeted advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. When you choose to share your contact details with a venue's mailing list, that is a disclosure you direct, not a sale. If we use de-identified information, we keep it in de-identified form and do not attempt to re-identify it, except to test that our de-identification works where the law allows.

d. California "Shine the Light"

California residents may ask which third parties we disclosed personal information to for their own direct marketing in the previous calendar year. The only such disclosure we make is to a venue's mailing list, and only after you opt in; you can withdraw at any time from Settings → Venue mailing lists. To ask which venues received your details, email privacy@leaguehaus.app.

e. Nevada

We do not sell covered information as defined by Nevada law. Nevada residents may still send us an opt-out request through the contact details in Section 15.

11. EEA / UK Residents (GDPR)

Controller. LeagueHaus LLC (contact details in Section 15) is the controller of your account and Service data under the GDPR and UK GDPR. A venue that runs a league may act as an independent controller of the league information it manages and of any contact export it downloads after you opt in; for its use of that information, contact the venue directly.

a. Legal bases

b. Transfers and your rights

Section 5 explains how we safeguard transfers to the United States. You have the rights listed in Section 9, including the right to object at any time to processing based on our legitimate interests, and to withdraw consent without affecting processing that took place before you withdrew it. You also have the right to lodge a complaint with the data protection authority where you live or work — in the UK, the Information Commissioner's Office — though we would welcome the chance to address your concern first.

12. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information to us, contact us and we will delete it. Some regions require a higher age threshold (e.g., 16 in parts of the EEA); we comply with the threshold applicable to your jurisdiction.

13. Do Not Track

We do not respond to Do Not Track (DNT) signals because there is no industry-standard interpretation of them. We do not engage in cross-site tracking regardless of DNT settings, and because we do not sell or share personal information, there is nothing for an opt-out preference signal such as Global Privacy Control to switch off.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date. If changes are material, we will provide additional notice (for example, by email or an in-product banner) before the changes take effect.

15. Contact Us

For privacy-related questions or to exercise your rights, contact:

LeagueHaus LLC
1128 Clearspring Dr
Charleston, SC 29412, United States
privacy@leaguehaus.app